```

[Congressional Bills 118th Congress]
[From the U.S. Government Publishing Office]
[H.R. 8918 Introduced in House (IH)]

<DOC>

118th CONGRESS
  2d Session
                                H. R. 8918

     To amend the Controlled Substances Act to require electronic 
communication service providers and remote computing services to report 
   to the Attorney General certain controlled substances violations.

_______________________________________________________________________

                    IN THE HOUSE OF REPRESENTATIVES

                              July 2, 2024

 Ms. Craig (for herself, Mrs. Miller-Meeks, Ms. Schrier, Mr. Crenshaw, 
Mr. Davis of North Carolina, and Mr. LaTurner) introduced the following 
 bill; which was referred to the Committee on Energy and Commerce, and 
   in addition to the Committee on the Judiciary, for a period to be 
subsequently determined by the Speaker, in each case for consideration 
  of such provisions as fall within the jurisdiction of the committee 
                               concerned

_______________________________________________________________________

                                 A BILL

 
     To amend the Controlled Substances Act to require electronic 
communication service providers and remote computing services to report 
   to the Attorney General certain controlled substances violations.

    Be it enacted by the Senate and House of Representatives of the 
United States of America in Congress assembled,

SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Cooper Davis and Devin Norring 
Act''.

SEC. 2. REPORTING REQUIREMENTS OF ELECTRONIC COMMUNICATION SERVICE 
              PROVIDERS AND REMOTE COMPUTING SERVICES FOR CERTAIN 
              CONTROLLED SUBSTANCES VIOLATIONS.

    (a) Amendments to Controlled Substances Act.--
            (1) In general.--Part E of the Controlled Substances Act 
        (21 U.S.C. 871 et seq.) is amended by adding at the end the 
        following:

``reporting requirements of electronic communication service providers 
    and remote computing services for certain controlled substances 
                               violations

    ``Sec. 521.  (a) Definitions.--In this section--
            ``(1) the term `electronic communication service' has the 
        meaning given that term in section 2510 of title 18, United 
        States Code;
            ``(2) the term `electronic mail address' has the meaning 
        given that term in section 3 of the CAN-SPAM Act of 2003 (15 
        U.S.C. 7702);
            ``(3) the term `Internet' has the meaning given that term 
        in section 1101 of the Internet Tax Freedom Act (47 U.S.C. 151 
        note);
            ``(4) the term `provider' means an electronic communication 
        service provider or remote computing service;
            ``(5) the term `remote computing service' has the meaning 
        given that term in section 2711 of title 18, United States 
        Code; and
            ``(6) the term `website' means any collection of material 
        placed in a computer server-based file archive so that it is 
        publicly accessible, over the Internet, using hypertext 
        transfer protocol or any successor protocol.
    ``(b) Duty To Report.--
            ``(1) General duty.--In order to reduce the proliferation 
        of the unlawful sale, distribution, or manufacture (as 
        applicable) of counterfeit substances and certain controlled 
        substances, a provider shall, as soon as reasonably possible 
        after obtaining actual knowledge of any facts or circumstances 
        described in paragraph (2), and in any event not later than 60 
        days after obtaining such knowledge, submit to the Drug 
        Enforcement Administration a report containing--
                    ``(A) the mailing address, telephone number, 
                facsimile number, and electronic mailing address of, 
                and individual point of contact for, such provider;
                    ``(B) information described in subsection (c) 
                concerning such facts or circumstances; and
                    ``(C) for purposes of subsection (j), information 
                indicating whether the facts or circumstances were 
                discovered through content moderation conducted by a 
                human or via a non-human method, including use of an 
                algorithm, machine learning, or other means.
            ``(2) Facts or circumstances.--The facts or circumstances 
        described in this paragraph are any facts or circumstances 
        establishing that a crime is being or has already been 
        committed involving--
                    ``(A) creating, manufacturing, distributing, 
                dispensing, or possession with intent to manufacture, 
                distribute, or dispense--
                            ``(i) fentanyl; or
                            ``(ii) methamphetamine;
                    ``(B) creating, manufacturing, distributing, 
                dispensing, or possession with intent to manufacture, 
                distribute, or dispense a counterfeit substance, 
                including a counterfeit substance purporting to be a 
                prescription drug; or
                    ``(C) offering, dispensing, or administering an 
                actual or purported prescription pain medication or 
                prescription stimulant by any individual or entity that 
                is not a practitioner or online pharmacy, including an 
                individual or entity that falsely claims to be a 
                practitioner or online pharmacy.
            ``(3) Permitted actions based on reasonable belief.--In 
        order to reduce the proliferation of the unlawful sale, 
        distribution, or manufacture (as applicable) of counterfeit 
        substances and certain controlled substances, if a provider has 
        a reasonable belief that facts or circumstances described in 
        paragraph (2) exist, the provider may submit to the Drug 
        Enforcement Administration a report described in paragraph (1).
    ``(c) Contents of Report.--
            ``(1) In general.--To the extent the information is within 
        the custody or control of a provider, the facts or 
        circumstances included in each report under subsection (b)(1)--
                    ``(A) shall include, to the extent that it is 
                applicable and reasonably available, information 
                relating to the account involved in the commission of a 
                crime described in subsection (b)(2), such as the name, 
                address, electronic mail address, user or account 
                identification, Internet Protocol address, uniform 
                resource locator, screen names or monikers for the 
                account used or any other accounts associated with the 
                account user, or any other identifying information, 
                including self-reported identifying information, but 
                not including the contents of a wire communication or 
                electronic communication, as those terms are defined in 
                section 2510 of title 18, United States Code, except as 
                provided in subparagraph (B) of this paragraph; and
                    ``(B) may, at the sole discretion of the provider, 
                include the information described in paragraph (2) of 
                this subsection.
            ``(2) Other information.--The information referred to in 
        paragraph (1)(B) is the following:
                    ``(A) Historical reference.--Information relating 
                to when and how a user, subscriber, or customer of a 
                provider uploaded, transmitted, or received content 
                relating to the report or when and how content relating 
                to the report was reported to or discovered by the 
                provider, including a date and time stamp and time 
                zone.
                    ``(B) Geographic location information.--Information 
                relating to the geographic location of the involved 
                individual or website, which may include the Internet 
                Protocol address or verified address, or, if not 
                reasonably available, at least one form of geographic 
                identifying information, including area code or ZIP 
                Code, provided by the user, subscriber, or customer, or 
                stored or obtained by the provider, and any information 
                as to whether a virtual private network was used.
                    ``(C) Data relating to facts or circumstances.--Any 
                data, including symbols, photos, video, icons, or 
                direct messages, relating to activity involving the 
                facts or circumstances described in subsection (b)(2) 
                or other content relating to the crime.
                    ``(D) Complete communication.--The complete 
                communication containing the information of the crime 
                described in subsection (b)(2), including--
                            ``(i) any data or information regarding the 
                        transmission of the communication; and
                            ``(ii) any data or other digital files 
                        contained in, or attached to, the 
                        communication.
            ``(3) User, subscriber, or customer submitted reports.--In 
        the case of a report under subsection (b)(3), the provider may, 
        at its sole discretion, include in the report information 
        submitted to the provider by a user, subscriber, or customer 
        alleging facts or circumstances described in subsection (b)(2) 
        if the provider, upon review, has a reasonable belief that the 
        alleged facts or circumstances exist.
    ``(d) Handling of Reports.--Upon receipt of a report submitted 
under subsection (b), the Administrator of the Drug Enforcement 
Administration--
            ``(1) shall conduct a preliminary review of such report; 
        and
            ``(2) after completing the preliminary review, shall--
                    ``(A) conduct further investigation of the report, 
                which may include making the report available to other 
                Federal, State, or local law enforcement agencies 
                involved in the investigation of crimes described in 
                subsection (b)(2), if the Administrator determines that 
                the report facially contains sufficient information to 
                warrant and permit further investigation; or
                    ``(B) conclude that no further investigative steps 
                are warranted or possible, or that insufficient 
                evidence exists to make a determination, and close the 
                report.
    ``(e) Attorney General Responsibilities.--
            ``(1) In general.--The Attorney General shall enforce this 
        section.
            ``(2) Designation of federal agencies.--The Attorney 
        General may designate a Federal law enforcement agency or 
        agencies to which the Drug Enforcement Administration may 
        forward a report under subsection (d).
            ``(3) Data minimization requirements.--The Attorney General 
        shall take reasonable measures to--
                    ``(A) limit the storage of a report submitted under 
                subsection (b) and its contents to the amount that is 
                necessary to carry out the investigation of crimes 
                described in subsection (b)(2); and
                    ``(B) store a report submitted under subsection (b) 
                and its contents only as long as is reasonably 
                necessary to carry out an investigation of crimes 
                described in subsection (b)(2) or make the report 
                available to other agencies under subsection (d)(2)(A), 
                after which time the report and its contents shall be 
                deleted unless the preservation of a report has future 
                evidentiary value.
    ``(f) Failure To Comply With Requirements.--
            ``(1) Criminal penalty.--
                    ``(A) Offense.--It shall be unlawful for a provider 
                to knowingly fail to submit a report required under 
                subsection (b)(1).
                    ``(B) Penalty.--A provider that violates 
                subparagraph (A) shall be fined--
                            ``(i) in the case of an initial violation, 
                        not more than $190,000; and
                            ``(ii) in the case of any second or 
                        subsequent violation, not more than $380,000.
            ``(2) Civil penalty.--In addition to any other available 
        civil or criminal penalty, a provider shall be liable to the 
        United States Government for a civil penalty in an amount not 
        less than $50,000 and not more than $100,000 if the provider 
        knowingly submits a report under subsection (b) that--
                    ``(A) contains materially false or fraudulent 
                information; or
                    ``(B) omits information described in subsection 
                (c)(1)(A) that is reasonably available.
    ``(g) Protection of Privacy.--Nothing in this section shall be 
construed to--
            ``(1) require a provider to monitor any user, subscriber, 
        or customer of that provider;
            ``(2) require a provider to monitor the content of any 
        communication of any person described in paragraph (1);
            ``(3) require a provider to affirmatively search, screen, 
        or scan for facts or circumstances described in subsection 
        (b)(2);
            ``(4) permit actual knowledge to be proven based solely on 
        a provider's decision not to engage in additional verification 
        or investigation to discover facts and circumstances that are 
        not readily apparent, so long as the provider does not 
        deliberately blind itself to those violations; or
            ``(5) prohibit a provider from using end-to-end encryption 
        or require a provider to decrypt encrypted communications.
    ``(h) Conditions of Disclosure of Information Contained Within 
Report.--
            ``(1) In general.--Except as provided in paragraph (2), a 
        law enforcement agency that receives a report under subsection 
        (d) shall not disclose any information contained in that 
        report.
            ``(2) Permitted disclosures by law enforcement.--A law 
        enforcement agency may disclose information in a report 
        received under subsection (d)--
                    ``(A) to an attorney for the government for use in 
                the performance of the official duties of that 
                attorney, including providing discovery to a defendant;
                    ``(B) to such officers and employees of that law 
                enforcement agency, as may be necessary in the 
                performance of their investigative and recordkeeping 
                functions;
                    ``(C) to such other government personnel (including 
                personnel of a State or subdivision of a State) as are 
                determined to be necessary by an attorney for the 
                government to assist the attorney in the performance of 
                the official duties of the attorney in enforcing 
                Federal criminal law;
                    ``(D) if the report discloses an apparent violation 
                of State criminal law, to an appropriate official of a 
                State or subdivision of a State for the purpose of 
                enforcing such State law;
                    ``(E) to a defendant in a criminal case or the 
                attorney for that defendant to the extent the 
                information relates to a criminal charge pending 
                against that defendant;
                    ``(F) to a provider if necessary to facilitate 
                response to legal process issued in connection to a 
                criminal investigation, prosecution, or post-conviction 
                remedy relating to that report;
                    ``(G) as ordered by a court upon a showing of good 
                cause and pursuant to any protective orders or other 
                conditions that the court may impose; and
                    ``(H) in order to facilitate the enforcement of the 
                penalties authorized under subsection (f).
    ``(i) Preservation.--
            ``(1) In general.--
                    ``(A) Request to preserve contents.--
                            ``(i) In general.--Subject to clause (ii), 
                        for the purposes of this section, a completed 
                        submission by a provider of a report to the 
                        Drug Enforcement Administration under 
                        subsection (b)(1) shall be treated as a request 
                        to preserve the contents provided in the 
                        report, and any data or other digital files 
                        that are reasonably accessible and may provide 
                        context or additional information about the 
                        reported material or person, for 90 days after 
                        the submission to the Drug Enforcement 
                        Administration.
                            ``(ii) Limitations on extension of 
                        preservation period.--
                                    ``(I) Stored communications act.--
                                The Drug Enforcement Administration may 
                                not submit a request to a provider to 
                                continue preservation of the contents 
                                of a report or other data described in 
                                clause (i) under section 2703(f) of 
                                title 18, United States Code, beyond 
                                the required period of preservation 
                                under clause (i) of this subparagraph 
                                unless the Drug Enforcement 
                                Administration has an active or pending 
                                investigation involving the user, 
                                subscriber, or customer account at 
                                issue in the report.
                                    ``(II) Rule of construction.--
                                Nothing in subclause (I) shall preclude 
                                another Federal, State, or local law 
                                enforcement agency from seeking 
                                continued preservation of the contents 
                                of a report or other data described in 
                                clause (i) under section 2703(f) of 
                                title 18, United States Code.
                    ``(B) Notification to user.--A provider may not 
                notify a user, subscriber, or customer of the provider 
                of a preservation request described in subparagraph (A) 
                unless--
                            ``(i) the provider has notified the Drug 
                        Enforcement Administration of its intent to 
                        provide that notice; and
                            ``(ii) 45 business days have elapsed since 
                        the notification under clause (i).
            ``(2) Protection of preserved materials.--A provider 
        preserving materials under this section shall maintain the 
        materials in a secure location and take appropriate steps to 
        limit access to the materials by agents or employees of the 
        service to that access necessary to comply with the 
        requirements of this subsection.
            ``(3) Authorities and duties not affected.--Nothing in this 
        section shall be construed as replacing, amending, or otherwise 
        interfering with the authorities and duties under section 2703 
        of title 18, United States Code.
            ``(4) Relation to reporting requirement.--Submission of a 
        report as required by subsection (b)(1) does not satisfy the 
        obligations under this subsection.
    ``(j) Annual Report.--Not later than 1 year after the date of 
enactment of the Cooper Davis and Devin Norring Act, and annually 
thereafter, the Administrator of the Drug Enforcement Administration 
shall publish a report that includes, for the reporting period--
            ``(1) the total number of reports received from providers 
        under subsection (b)(1);
            ``(2) the number of reports received under subsection 
        (b)(1) disaggregated by--
                    ``(A) the provider on whose electronic 
                communication service or remote computing service the 
                crime for which there are facts or circumstances 
                occurred; and
                    ``(B) the subsidiary of a provider, if any, on 
                whose electronic communication service or remote 
                computing service the crime for which there are facts 
                or circumstances occurred;
            ``(3) the number of reports received under subsection 
        (b)(1) that led to convictions in cases investigated by the 
        Drug Enforcement Administration;
            ``(4) the number of reports received under subsection 
        (b)(1) that lacked actionable information;
            ``(5) the number of reports received under subsection 
        (b)(1) where the facts or circumstances of a crime were 
        discovered through--
                    ``(A) content moderation conducted by a human; or
                    ``(B) a non-human method including use of an 
                algorithm, machine learning, or other means;
            ``(6) the number of reports received under subsection 
        (b)(1) that were made available to other law enforcement 
        agencies, disaggregated by--
                    ``(A) the number of reports made available to 
                Federal law enforcement agencies;
                    ``(B) the number of reports made available to State 
                law enforcement agencies; and
                    ``(C) the number of reports made available to local 
                law enforcement agencies; and
            ``(7) the number of requests to providers to continue 
        preservation of the contents of a report or other data 
        described in subsection (i)(1)(A)(i) submitted by the Drug 
        Enforcement Administration under section 2703(f) of title 18, 
        United States Code.
    ``(k) Prohibition on Submission of User, Subscriber, Customer, or 
Anonymous Reports by Law Enforcement.--
            ``(1) In general.--No Federal, Tribal, State, or local law 
        enforcement officer acting in an official capacity may submit a 
        report to a provider or arrange for another individual to 
        submit a report to a provider on behalf of the officer under 
        this section.
            ``(2) Remedy for violation.--No part of the contents of a 
        provider's report made under subsection (b)(1) or (b)(3) and no 
        evidence derived therefrom may be received in evidence in any 
        trial, hearing, or other proceeding in or before any court, 
        department, officer, agency, regulatory body, legislative 
        committee, or other authority of the United States, a State, or 
        a political subdivision thereof if that provider report 
        resulted from an action prohibited by paragraph (1) of this 
        subsection.
    ``(l) Exemptions.--Subsections (b) through (k) shall not apply to a 
provider of broadband internet access service, as that term is defined 
in section 8.1(b) of title 47, Code of Federal Regulations (or any 
successor regulation), or a provider of a text messaging service, as 
that term is defined in section 227 of the Communications Act of 1934 
(47 U.S.C. 227), insofar as the provider is acting as a provider of 
such service.''.
            (2) Technical and conforming amendment.--The table of 
        contents for the Controlled Substances Act (21 U.S.C. 801 et 
        seq.) is amended by inserting after the item relating to 
        section 520 the following:

``Sec. 521. Reporting requirements of electronic communication service 
                            providers and remote computing services for 
                            certain controlled substances 
                            violations.''.
    (b) Conforming Amendments to Stored Communications Act.--
            (1) In general.--Section 2702 of title 18, United States 
        Code, is amended--
                    (A) in subsection (b)--
                            (i) in paragraph (8), by striking ``or'' at 
                        the end;
                            (ii) in paragraph (9), by striking the 
                        period at the end and inserting ``; or''; and
                            (iii) by adding at the end the following:
            ``(10) to the Drug Enforcement Administration, in 
        connection with a report submitted thereto under section 521 of 
        the Controlled Substances Act.''; and
                    (B) in subsection (c)--
                            (i) in paragraph (6), by striking ``or'' at 
                        the end;
                            (ii) in paragraph (7), by striking the 
                        period at the end and inserting ``; or''; and
                            (iii) by adding at the end the following:
            ``(8) to the Drug Enforcement Administration, in connection 
        with a report submitted thereto under section 521 of the 
        Controlled Substances Act.''.
            (2) Technical amendment.--Paragraph (7) of section 2702(b) 
        of title 18, United States Code, is amended to read as follows:
            ``(7) to a law enforcement agency if the contents--
                    ``(A) were inadvertently obtained by the service 
                provider; and
                    ``(B) appear to pertain to the commission of a 
                crime;''.

SEC. 3. SEVERABILITY.

    If any provision of this Act or amendment made by this Act, or the 
application of such a provision or amendment to any person or 
circumstance, is held to be unconstitutional, the remaining provisions 
of this Act and amendments made by this Act, and the application of 
such provision or amendment to any other person or circumstance, shall 
not be affected thereby.
                                 <all>
```